🐛 fix(kanban): pin worker git identity to host config at spawn

[cwest]

Problem

Dispatched kanban workers clone/branch a repo and commit their work. When the
cloned repo carries no local git identity, the worker's runtime authors branch
commits under a synthesized per-profile identity (e.g. <name>@<host>.local).
Because that author differs from the squash-merge author, GitHub's
squash-merge auto-appends a Co-authored-by: <name> <name@…> trailer for it
into every merge commit body — baking an unwanted author into git metadata on
each merge. The squash author is correct; only the auto-derived co-author
trailer is wrong, and it recurs on every merge.

Fix

Resolve the host's canonical git config user.name / user.email once at
spawn (_default_spawn) and pin them into the worker subprocess env as
GIT_AUTHOR_* / GIT_COMMITTER_*. Env-level git identity overrides repo-local
and global config, so every worker commit is authored as the host maintainer
regardless of what identity the worker's runtime would otherwise set. With all
branch commits sharing the squash author, GitHub finds no distinct author and
adds no trailer.

• Forward, non-destructive: stops new trailers at the source on every repo a
  worker touches; no history rewrite.
• Standard git env vars, not a new HERMES_* config var — the identity value
  is read from the host's existing git config, the source of truth.
• Identity is omitted (never set empty) when host config can't be resolved,
  so git's own config chain still applies and the spawn never crashes.

Tests

tests/hermes_cli/test_kanban_worker_git_identity.py (4 tests):

• spawn env pins GIT_AUTHOR_* / GIT_COMMITTER_* from resolved identity
• spawn omits the vars (no empty injection, no crash) when unresolvable
• _resolve_worker_git_identity reads both keys from git config
• resolution returns None (not empty strings) when config is missing

Verification:

• 4/4 new tests pass; 241/241 across kanban_db + spawn + goal-mode suites; 0
  regressions (the one failing hermes_cli test is a pre-existing systemd test
  that fails identically on the base branch — macOS has no systemd).
• E2E: a repo with local user.email set to a persona commits as the persona
  bare, but commits as the host identity when the GIT_* env vars are set —
  confirming the override prevents the squash co-author trailer.
• ruff check clean on both changed files; commit signed (good signature).

Draft pending review.